@ouro.bot/cli 0.1.0-alpha.823 → 0.1.0-alpha.824

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.824",
+      "changes": [
+        "Sanctuary: vault removal is reachable only from the authority install transaction, so the destructive verb can no longer be run bare against a host with no root authority installed."
+      ]
+    },
     {
       "version": "0.1.0-alpha.823",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.823",
+  "runtimeVersion": "0.1.0-alpha.824",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.823</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.824</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -739,6 +739,7 @@ class SanctuaryAuthorityRootLifecycle {
             "--mount", `type=bind,src=${BUNDLE},dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly`,
             "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,mode=0700",
+            "--env", `OURO_AUTHORITY_REMOVE_INTERLOCK=${this.#request.epochId}`,
             this.#transaction.targetImageId, "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js", "vault", operation,
         ], input === undefined ? undefined : JSON.stringify(input)));
     }
@@ -748,6 +749,17 @@ async function runSanctuaryAuthorityRootCli(argv, write = (text) => process.stdo
     if (process.getuid() !== 0 || process.getgid() !== 0)
         throw new Error("Sanctuary root lifecycle requires root");
     if (argv.length === 2 && argv[0] === "vault") {
+        // `remove` is the one vault verb that can strand the household. It is safe
+        // only inside the install transaction, which has already proven the same
+        // token into root custody at `verify-token-rotation`. Run bare against a
+        // host with no installed root authority it leaves the Butler with no route
+        // to Telegram at all, which is how Sanctuary lost its front door on
+        // 2026-09-21. This is a safety interlock against invoking it outside its
+        // transaction, not a privilege boundary: root can always set the variable,
+        // but it can no longer do this by reaching for a documented verb.
+        if (argv[1] === "remove" && !process.env.OURO_AUTHORITY_REMOVE_INTERLOCK) {
+            throw new Error("Sanctuary vault removal runs only inside the authority install transaction; use docker-man-template-transaction.mjs authority-install");
+        }
         const input = argv[1] === "restore" ? JSON.parse(fs.readFileSync(0, "utf8")) : undefined;
         write(`${JSON.stringify(await (0, sanctuary_authority_vault_migration_1.migrateSanctuaryAuthorityVault)(argv[1], input))}\n`);
         return;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.823",
+  "version": "0.1.0-alpha.824",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.823",
+      "version": "0.1.0-alpha.824",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.823",
+  "version": "0.1.0-alpha.824",
   "engines": {
     "node": ">=22"
   },